DF-4055 / dmesg_s1.txt
dfet: === go=1: dispatching REAL kernel handlers (built-in 'device et'): et_intr=0xffffffff804b8bd0 et_txeof=0xffffffff804b6740 et_stop=0xffffffff804b5ed0 et_tick=0xffffffff804b87d0 et_newbuf_hdr=0xffffffff804b9450 et_newbuf_cluster=0xffffffff804b9460 === dfet: layout: sizeof(et_softc)=0x85c8 sc_tick=0x400 sc_rx_data=0x520 sc_tx_data=0x6568 sc_rxstat_ring=0x480 sc_rx_status=0x4a8 if_timer=0x6a MHLEN=248 MCLBYTES=2048 ET_RX_NSTAT=1024 ET_TX_NDESC=512 dfet: dma: tx_ring=0x100000 rxst=0x106000 rxsd=0xbdfc000 dfet: setup complete: rings armed by REAL et_newbuf_hdr/et_newbuf_cluster (2 x 512 mbufs), serializer ready dfet: S1[0]: slot=0 crafted LEN=60000 BUFIDX=0 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer dfet: if_input: m=0xfffff80089786400 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0 dfet: frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 01 df 55 0e 0f 10 11 dfet: OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: 6174696f6e20616e 640a232050617373 776f726441757468 656e746963617469 dfet: S1[1]: slot=1 crafted LEN=60000 BUFIDX=1 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer dfet: if_input: m=0xfffff80089786200 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0 dfet: frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 02 df 55 0f 10 11 12 dfet: OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: ffffffffffff00df 40550001df550e0f 1011121314151617 18191a1b1c1d1e1f dfet: S1[2]: slot=2 crafted LEN=60000 BUFIDX=2 RINGIDX=1 (cluster ring); dispatching REAL et_intr under serializer dfet: if_input: m=0xfffff80089785e00 m_len=59996 pkthdr.len=59996 M_EXT=1 ext_size=2048 (backing-store capacity) rcvif=dfet0 dfet: frame[0..17]=ff ff ff ff ff ff 00 df 40 55 00 03 df 55 10 11 12 13 dfet: OOB: m_len exceeds backing store by 57948 bytes; heap bytes [2048..2080) past the cluster: 0000000000000000 0000010052540012 345652550a000202 0800400000000000 dfet: S1: delivered=3 oob_events=3 ipackets=3 ierrors=0 (MHLEN=248 MCLBYTES=2048; claimed buflen=60000) dfet: *** S1 BUG CONFIRMED (DF-4055): the REAL et_intr/inlined-et_rxeof handed if_input mbufs with m_len=59996 on a 2048-byte cluster 3/3 times - m_len runs 57948 bytes past the allocation (if_et.c:1863,1896); bytes past the cluster are adjacent kernel heap ***